Secure RBAC Test
Enforce/test the state of each policy's engagement for
baremetal nodes, project reader and system reader.
The tests use a try clause, catches the exception and
checks the response status code match what is expected.
Change-Id: I0b5f8eb881462f5d78f65bd37fbb8b296d9880eb
diff --git a/ironic_tempest_plugin/tests/api/base.py b/ironic_tempest_plugin/tests/api/base.py
index 5469579..6ebb162 100644
--- a/ironic_tempest_plugin/tests/api/base.py
+++ b/ironic_tempest_plugin/tests/api/base.py
@@ -482,3 +482,16 @@
"""
resp, body = cls.client.create_allocation(resource_class, **kwargs)
return resp, body
+
+
+class BaseBaremetalRBACTest(BaseBaremetalTest):
+
+ # Unless otherwise superceeded by a version, RBAC tests generally start at
+ # version 1.70 as that is when System scope and the delineation occured.
+ min_microversion = '1.70'
+
+ @classmethod
+ def skip_checks(cls):
+ super(BaseBaremetalRBACTest, cls).skip_checks()
+ if not CONF.enforce_scope.ironic:
+ raise cls.skipException('RBAC tests for Ironic are not enabled.')